Context
An authenticated user asks an API for an invoice by ID. Authentication establishes who made the request. It does not, by itself, establish that this user may read that invoice or change its payment details.
Write the rule for the business object
Start with a permission matrix for an invoice: who can read it, download its PDF, correct an address, approve it or issue a refund? Include customer users, finance staff, support staff and integrations. These operations usually need different rules.
OWASP identifies broken object-level authorization as an API risk that can occur with many kinds of record IDs, including UUIDs. Its guidance calls for permission checks on operations that use supplied IDs to access records. An unpredictable ID is useful but does not replace the access rule.
Apply the rule to related resources
Follow the invoice to attachments, download endpoints, search results, exports and background jobs. A secure invoice detail endpoint does not protect a PDF served by an unrelated public URL. Likewise, omitting an invoice from a list does not establish that a direct lookup is denied.
Use trusted account relationships to resolve access. Avoid relying on a customer ID supplied by the caller when the server can determine the caller's current customer membership itself.
Test with two deliberately different accounts
- Create an invoice under customer A and confirm its expected user can access it.
- Use customer B's session with the same invoice ID on every relevant read and write operation.
- Repeat for attachments, exports and state changes.
- Suspend the account or remove its membership and repeat the sensitive operations.
- Check the database and downstream systems to confirm denied actions had no side effects.
Use synthetic fixtures rather than real customer documents in automated tests. Keep credentials and financial details out of test logs.
Make permission changes reviewable
Keep the matrix next to the API contract and include negative tests in release validation. When the business introduces shared accounts, delegated approvals or external support access, review the existing endpoints rather than assuming the old ownership test still fits.
See API integrations and cloud security consulting for related engineering scope.